Re: [TLS] Encryption of TLS 1.3 content type

On Fri, Jul 25, 2014 at 1:57 PM, Yoav Nir <ynir.ietf@gmail.com> wrote:

> Hi.
>
> I believe that changing the 5-byte record header will cause us trouble.
> Passive IDS/IPS devices follow TLS streams to detect certain attacks. They
> will cut connections. I also believe that it is impossible to “run some
> tests” because there are literally dozens of different such middleboxes,
> with multiple software/firmware versions available for each type.
>
> I therefore support leaving the 5-byte header as it is, fixing the
> ContentType value to 23 for all encrypted records, and having another
> contentType byte within the encrypted record.

Yoav,

The tests I had in mind were having browsers form connections back to
some central server and measure how it works. That's not perfect, but
it lets us test with a large corpus.

-Ekr

> Yoav
>
> On Jul 25, 2014, at 1:37 PM, Joseph Salowey (jsalowey) <jsalowey@cisco.com>
> wrote:
>
> > At the interim meeting on July 20, 2014 there was general consensus to
> support the encryption of TLS 1.3 content type.  The favored approach was
> to remove the content type and version from the TLS record layer header and
> add the content type to the encrypted data.   The proposal is to update the
> draft to document this approach and try to run some tests to see if this
> causes much grief with middle boxes.  If you object to this proposal please
> respond to the list by Friday, August 01, 2014.
> > _______________________________________________
> > TLS mailing list
> > TLS@ietf.org
> > https://www.ietf.org/mailman/listinfo/tls
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>